full-disclosure - Re: iDEFENSE Security Advisory 12.19.02: Multiple Security Vulnerabilities in Common Unix Printing System (CUPS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0212221400010.16803-100000@clarity.local>
From: zen-parse at gmx.net (zen-parse)
Subject: Re: iDEFENSE Security Advisory 12.19.02: Multiple Security
 Vulnerabilities in Common Unix Printing System (CUPS)

Joe Testa (Joe_Testa@...id7.com) wrote:
> So, it doesn't seem like CUPSd is vulnerable to just any random attacker
> who happens to be passing by.  I've tested this against RedHat 8.0's
> 'cups-1.1.15-10.src.rpm', along with ftp.cups.org's v1.1.14 and v1.1.17.

Maybe not just any random attacker.

Depending on configuration the server may be setup to allow access from
other machines on the local network. (Check the access control list
stuff).

This, of course, probably never happens in the real world. I mean, it
would be too useful to be able to share a printer. So of course, it
wouldn't affect anyone. Adding a feature to allow it was probably just an 
exercise to see if they could do it. </sarcasm>

Remote access can also be given (via issue 1) by sending an email with an
image link that exploits the handling of variables, allowing execution of
commands on the local machine. This can then be used to further elevate  
privs via the issue you mentioned, or one of the other issues.

-- zen-parse

-- 
-------------------------------------------------------------------------
1) If this message was posted to a public forum by zen-parse@....net, it 
may be redistributed without modification. 
2) In any other case the contents of this message is confidential and not 
to be distributed in any form without express permission from the author.